Lucene search
HistoryJul 29, 2014 - 11:10 a.m.
CVE-2014-3552
CVSS2
6
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
AI Score
6.3
Confidence
Low
EPSS
0.003
Percentile
71.4%
The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is empty, which allows remote authenticated users to hijack sessions via crafted plugin interaction.
Affected configurations
Node
moodlemoodleMatch2.4.0
ORmoodlemoodleMatch2.4.1
ORmoodlemoodleMatch2.4.2
ORmoodlemoodleMatch2.4.3
ORmoodlemoodleMatch2.4.4
ORmoodlemoodleMatch2.4.5
ORmoodlemoodleMatch2.4.6
ORmoodlemoodleMatch2.4.7
ORmoodlemoodleMatch2.4.8
ORmoodlemoodleMatch2.4.9
ORmoodlemoodleMatch2.4.10
Node
moodlemoodleRange≤2.3.11
ORmoodlemoodleMatch2.3.0
ORmoodlemoodleMatch2.3.1
ORmoodlemoodleMatch2.3.2
ORmoodlemoodleMatch2.3.3
ORmoodlemoodleMatch2.3.4
ORmoodlemoodleMatch2.3.5
ORmoodlemoodleMatch2.3.6
ORmoodlemoodleMatch2.3.7
ORmoodlemoodleMatch2.3.8
ORmoodlemoodleMatch2.3.9
ORmoodlemoodleMatch2.3.10
Node
moodlemoodleMatch2.5.0
ORmoodlemoodleMatch2.5.1
ORmoodlemoodleMatch2.5.2
ORmoodlemoodleMatch2.5.3
ORmoodlemoodleMatch2.5.4
ORmoodlemoodleMatch2.5.5
ORmoodlemoodleMatch2.5.6
| Vendor | Product | Version | CPE |
|---|---|---|---|
| moodle | moodle | 2.4.0 | cpe:2.3:a:moodle:moodle:2.4.0:*:*:*:*:*:*:* |
| moodle | moodle | 2.4.1 | cpe:2.3:a:moodle:moodle:2.4.1:*:*:*:*:*:*:* |
| moodle | moodle | 2.4.2 | cpe:2.3:a:moodle:moodle:2.4.2:*:*:*:*:*:*:* |
| moodle | moodle | 2.4.3 | cpe:2.3:a:moodle:moodle:2.4.3:*:*:*:*:*:*:* |
| moodle | moodle | 2.4.4 | cpe:2.3:a:moodle:moodle:2.4.4:*:*:*:*:*:*:* |
| moodle | moodle | 2.4.5 | cpe:2.3:a:moodle:moodle:2.4.5:*:*:*:*:*:*:* |
| moodle | moodle | 2.4.6 | cpe:2.3:a:moodle:moodle:2.4.6:*:*:*:*:*:*:* |
| moodle | moodle | 2.4.7 | cpe:2.3:a:moodle:moodle:2.4.7:*:*:*:*:*:*:* |
| moodle | moodle | 2.4.8 | cpe:2.3:a:moodle:moodle:2.4.8:*:*:*:*:*:*:* |
| moodle | moodle | 2.4.9 | cpe:2.3:a:moodle:moodle:2.4.9:*:*:*:*:*:*:* |
Related
prion
prion
Authentication flaw
2014-07-29 11:10:00
ubuntucve
ubuntucve
CVE-2014-3552
2014-07-29 00:00:00
cvelist
cvelist
CVE-2014-3552
2014-07-29 10:00:00
cve
cve
CVE-2014-3552
2014-07-29 11:10:32
veracode
veracode
Sessions Hijacking
2017-07-18 08:26:22
nessus
nessus
Fedora 20 : moodle-2.5.7-1.fc20 (2014-8601)
2014-07-31 00:00:00
Fedora 19 : moodle-2.4.11-1.fc19 (2014-8609)
2014-07-31 00:00:00
openvas
openvas
Fedora Update for moodle FEDORA-2014-10802
2014-10-01 00:00:00
Fedora Update for moodle FEDORA-2014-15102
2014-11-26 00:00:00
Fedora Update for moodle FEDORA-2014-8601
2014-08-05 00:00:00
fedora
fedora
[SECURITY] Fedora 20 Update: moodle-2.5.9-1.fc20
2014-11-25 15:30:01
[SECURITY] Fedora 20 Update: moodle-2.5.8-1.fc20
2014-09-25 10:46:26
[SECURITY] Fedora 20 Update: moodle-2.5.7-1.fc20
2014-07-30 07:03:13
CVSS2
6
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
AI Score
6.3
Confidence
Low
EPSS
0.003
Percentile
71.4%
Related for NVD:CVE-2014-3552